Set up and manage network address translation with Public NAT

This page describes how to set up and manage network address translation (NAT) by using Public NAT. Before setting up Public NAT, see the Public NAT overview.

Limitations

  • If you change the network tier of the automatically allocated IP addresses for a Cloud NAT gateway, all connections on the previously allocated IP addresses immediately close.

  • If you use manual NAT IP address allocation and you change the IP addresses that are used for Cloud NAT, all connections on the previously allocated IP addresses immediately close. To avoid this, see Drain external IP addresses associated with NAT.

  • If you configure a Cloud NAT gateway with static port allocation and you reduce the minimum ports per virtual machine (VM) instance, established NAT connections might be broken. For more information, see Reducing ports per VM.

  • If you configure a Cloud NAT gateway with dynamic port allocation and you make any further configuration changes, established NAT connections might be broken. When the configuration changes, the number of ports allocated to each VM might be temporarily reset to the minimum number configured. For more information, see Reduce ports per VM.

  • If you configure a Cloud NAT gateway with dynamic port allocation and then turn off dynamic port allocation, all VM connections that use the NAT gateway are closed. For more information, see Switch port allocation method.

  • If Endpoint-Independent Mapping is enabled, you can't configure dynamic port allocation or NAT rules.

  • Cloud NAT doesn't support IP fragments.

  • A Cloud NAT configuration is tied to a Virtual Private Cloud (VPC) network. So, the configuration applies to all the resources that belong to the subnets of that network. You can't choose specific VMs to be served by a Cloud NAT gateway.

  • NAT64 is available only for IPv6-only Compute Engine VM instances, for the following machine series:

    • All second generation or earlier series
    • M3 series

    For more information, see Compute Engine terminology.

    For Google Kubernetes Engine (GKE) nodes, serverless endpoints, and regional internet network endpoint groups (NEGs), Public NAT translates only IPv4 addresses. For more information about which services in Google Cloud include IPv6-only support, see IPv6 support in Google Cloud.

Before you begin

Complete the following tasks before setting up Public NAT.

Get IAM permissions

The Compute Network Admin role (roles/compute.networkAdmin) includes the permissions that you need to configure Public NAT.

Prepare your environment

Depending on whether you want to use the Google Cloud console or gcloud CLI to set up Public NAT, configure the following resources in Google Cloud.

Console

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Compute Engine API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  6. Verify that billing is enabled for your Google Cloud project.

  7. Enable the Compute Engine API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

    8.

gcloud

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. Install the Google Cloud CLI.

  3. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  4. To initialize the gcloud CLI, run the following command: 

    gcloud init

  5. Create or select a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    • Create a Google Cloud project:

      gcloud projects create PROJECT_ID

      Replace PROJECT_ID with a name for the Google Cloud project you are creating.

    • Select the Google Cloud project that you created:

      gcloud config set project PROJECT_ID

      Replace PROJECT_ID with your Google Cloud project name.

  6. Verify that billing is enabled for your Google Cloud project.

  7. Enable the Compute Engine API:

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles. 

    gcloud services enable compute.googleapis.com

  8. Install the Google Cloud CLI.

  9. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  10. To initialize the gcloud CLI, run the following command: 

    gcloud init

  11. Create or select a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    • Create a Google Cloud project:

      gcloud projects create PROJECT_ID

      Replace PROJECT_ID with a name for the Google Cloud project you are creating.

    • Select the Google Cloud project that you created:

      gcloud config set project PROJECT_ID

      Replace PROJECT_ID with your Google Cloud project name.

  12. Verify that billing is enabled for your Google Cloud project.

  13. Enable the Compute Engine API:

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles. 

    gcloud services enable compute.googleapis.com
    14.

Configure DNS64

To use translation from IPv6 to IPv4 (NAT64), destination addresses must match the 64:ff9b::/96 prefix. You can configure DNS64 to automatically synthesize IPv4-embedded IPv6 addresses by prepending this prefix to your destination IPv4 addresses.

Skip this step if you want to use Cloud NAT only for IPv4 traffic.

Configure Public NAT

You configure Public NAT by creating a Cloud NAT gateway in the source VPC network. Each gateway is associated with a single VPC network, region, and Cloud Router. Cloud NAT uses Cloud Router only to group NAT configuration information and doesn't direct Cloud Router to use Border Gateway Protocol or add routes. NAT traffic doesn't pass through Cloud Router.

When creating a Cloud NAT gateway, you can configure the following options.

Configuration Supported options Description
Source endpoint type
  • VM instances, GKE nodes, Serverless
  • Managed proxy load balancers

By default, Public NAT provides NAT services to VM instances, GKE nodes, and serverless endpoints. To create a Cloud NAT gateway for these resources, complete the steps in the following section.

To create a Cloud NAT gateway for a regional internet NEG, see "Set up a Cloud NAT gateway" for the following:

For a full list of Google Cloud resources that Cloud NAT supports, see Cloud NAT overview.
Source IP version
  • IPv4 subnet ranges
  • IPv6 subnet ranges
  • IPv4 and IPv6 subnet ranges

Public NAT supports translation from IPv4 to IPv4 and from IPv6 to IPv4.

  • If you configure IPv4 subnet ranges, IPv4-only VM instances and dual-stack VM instances (using their IPv4 addresses) in IPv4-only and dual-stack subnets can communicate with IPv4 destinations on the internet.
  • If you configure IPv6 subnet ranges, IPv6-only VM instances in IPv6-only and dual-stack subnets can communicate with IPv4 destinations on the internet.
  • If you configure IPv4 and IPv6 subnet ranges, the following applies:
    • IPv4-only VM instances and dual-stack VM instances (using their IPv4 addresses) can communicate with IPv4 destinations on the internet.
    • Dual-stack VM instances can't use their IPv6 addresses to communicate with IPv4 destinations on the internet.
    • IPv6-only VM instances can communicate with IPv4 destinations on the internet.
Source subnets

For IPv4 traffic:

  • Primary and secondary ranges for all subnets
  • Primary ranges for all subnets
  • Custom

For IPv6 traffic:

  • All subnets
  • Custom

Public NAT supports the following subnet ranges in the region for the VPC network that you specify:

  • For IPv4 traffic: primary and secondary ranges. You can restrict which subnets and subnet ranges can use NAT.
  • For IPv6 traffic: internal and external ranges. You can restrict which subnets can use NAT.
IP address allocation
  • Automatic (recommended)
  • Manual

By default, Public NAT uses automatic NAT IP address allocation. This configuration automatically allocates the necessary external IP addresses to provide NAT services to a region. VM instances without external IP addresses in any subnet of the region are provided internet access through NAT. When you use automatic NAT IP address allocation, Google Cloud reserves IP addresses in your project. These addresses count against your in-use regional external IPv4 address quotas in the project.

You can manually allocate NAT IP addresses for a Cloud NAT gateway. These addresses count against the following quotas:

If you choose manual allocation, make sure to allocate enough IP addresses to avoid dropped packets.

For more information, see Public NAT IP addresses.
Network tier
  • Premium
  • Standard
 Public NAT lets you specify the Network Service Tiers from which the Cloud NAT gateway allocates external IP addresses. By default, the network tier is set to the current project-level tier.
  • When creating a Cloud NAT gateway with automatic NAT IP address allocation, you can assign NAT IP addresses from either Premium Tier or Standard Tier.
  • When creating a Cloud NAT gateway with manual NAT IP address allocation, you can choose to manually assign NAT IP addresses from either Premium Tier or Standard Tier or both, subject to certain conditions.
Advanced configurations
  • Dynamic port allocation
  • Endpoint-Independent Mapping
  • Logging
  • NAT timeouts

By default, Public NAT uses static port allocation, which means that each VM is allocated the same number of ports. You can configure dynamic port allocation with either automatic or manual NAT IP address allocation. Using dynamic port allocation lets the Cloud NAT gateway dynamically allocate ports to each VM based on usage. You can't enable Endpoint-Independent Mapping if your Cloud NAT gateway uses NAT rules or dynamic port allocation.

Logging is disabled by default. For information about NAT timeouts and their default values, see NAT timeouts.

Create a Cloud NAT gateway

Console

  1. In the Google Cloud console, go to the Cloud NAT page.

    Go to Cloud NAT

  2. Click Get started for the first Cloud NAT gateway or Create Cloud NAT gateway for subsequent gateways.

  3. In the Gateway name field, enter a name for the gateway.

  4. For NAT type, select Public.

  5. In the Select Cloud Router section, configure the following:

    1. In the Network field, select the VPC network in which you want to create the gateway.
    2. In the Region field, set the region for the gateway.
    3. In the Cloud Router field, select or create a Cloud Router in the region.

  6. In the Cloud NAT mapping section, for Source endpoint type, make sure the VM instances, GKE nodes, Serverless option is selected.

  7. In the Source IP version field, select the source IP version and then configure the source subnet ranges for which you want to use Cloud NAT.

    • For IPv4 subnet ranges, in the Source subnets field, select one of the following:
      • To use Cloud NAT for primary and secondary IP ranges for all subnets in the region, select Primary and secondary IP ranges for all subnets.
      • To use Cloud NAT only for primary IP ranges, select Primary IP ranges for all subnets.
      • To restrict which subnet IP ranges can use Cloud NAT, select Custom and do the following:
        1. In the Subnets section, select a subnet.
        2. In the IP ranges list, select the subnet IP ranges to include and click OK.
        3. Optional: If you want to specify additional ranges, click Add subnet and IP range and add another subnet.
    • For IPv6 subnet ranges, in the Source subnets field, select one of the following:
      • To use Cloud NAT for internal and external IP ranges for all subnets in the region, select All subnets.
      • To restrict which subnets can use Cloud NAT, select Custom and do the following:
        1. In the Subnets section, select a subnet.
        2. Optional: If you want to specify additional subnets, click Add subnet and add another subnet.

  8. Configure the NAT IP address allocation type and network tier by selecting one of the following:

    • To use automatic NAT IP address allocation, do the following:
      1. In the Cloud NAT IP addresses list, select Automatic (recommended).
      2. For Network service tier, choose either Premium or Standard.
    • To use manual NAT IP address allocation, do the following:
      1. In the Cloud NAT IP addresses list, select Manual.
      2. For Network service tier, choose either Premium or Standard.
      3. Select or create a static reserved external IP address to use for NAT.
      4. Optional: If you want to specify additional IP addresses, click Add IP address and then select or create an additional static reserved external IP address.
      5. Optional: If you want to create custom NAT rules, configure the Cloud NAT rules section. For an example configuration, see Create NAT rules.

  9. Optional: Adjust any of the following settings in the Advanced configurations section:

    • Whether to configure logging. By default, No logging is selected.
    • Whether to change how Cloud NAT allocates ports. By default, Enable Dynamic Port Allocation is deselected. For static port allocation, the Minimum ports per VM instance field is set to 64.
      • To update the minimum number of ports per VM instance for static port allocation, specify a value in the Minimum ports per VM instance field. This value can be set from 2 to 57344.
      • To configure dynamic port allocation, select Enable Dynamic Port Allocation and select a value for the Minimum ports per VM instance field (default is 32) and the Maximum ports per VM instance field (default is 65536).
    • Whether to update NAT timeouts for protocol connections. For information about these timeouts and their default values, see NAT timeouts.

  10. Click Create.

gcloud

To create a Cloud NAT gateway, use the gcloud compute routers nats create command. You can create a Cloud NAT gateway with all of its configuration options set to their default values, or you can customize your gateway configuration.

Create a Cloud NAT gateway with default settings

  1. Create a Cloud Router in the region of the VPC network where you want to use the Cloud NAT gateway. You need this Cloud Router to create your Cloud NAT gateway.

  2. Create the Cloud NAT gateway by running one of the following commands, depending on the IP version of the source subnet ranges for which you are configuring NAT.

    • Configure Cloud NAT for IPv4 subnet ranges:

      gcloud compute routers nats create NAT_CONFIG \
    --router=NAT_ROUTER \
    --region=REGION \
    --nat-all-subnet-ip-ranges \
    --auto-allocate-nat-external-ips

      This configuration enables NAT for all IPv4 subnet ranges in IPv4-only and dual-stack subnets in the region.

    • Configure Cloud NAT for IPv6 subnet ranges:

      gcloud compute routers nats create NAT_CONFIG \
    --router=NAT_ROUTER \
    --region=REGION \
    --nat64-all-v6-subnet-ip-ranges \
    --auto-allocate-nat-external-ips

      This configuration enables NAT for all IPv6 subnet ranges in IPv6-only and dual-stack subnets in the region.

    • Configure Cloud NAT for both IPv4 and IPv6 subnet ranges:

      gcloud compute routers nats create NAT_CONFIG \
    --router=NAT_ROUTER \
    --region=REGION \
    --nat-all-subnet-ip-ranges \
    --nat64-all-v6-subnet-ip-ranges \
    --auto-allocate-nat-external-ips

      This configuration enables NAT for all IPv4 and IPv6 subnet ranges in IPv4-only, dual-stack, and IPv6-only subnets in the region.

    Replace the following:

    • NAT_CONFIG: a name for your NAT configuration
    • NAT_ROUTER: the name of the Cloud Router that you created in the previous step
    • REGION: the region where you want to use the Cloud NAT gateway

Customize configuration settings for a Cloud NAT gateway

When creating a Cloud NAT gateway, you can customize its default configuration. For a full list of flags that you can use, see the gcloud compute routers nats create command.

Create a Cloud NAT gateway for IPv6 subnet ranges only if you are configuring NAT64 for Compute Engine VM instances. For GKE nodes, serverless endpoints, and regional internet NEGs, Public NAT translates only IPv4 addresses.

Create a Cloud NAT gateway:

  1. Create a Cloud Router in the region the VPC network where you want to use the Cloud NAT gateway. You need this Cloud Router to create your Cloud NAT gateway.

  2. Create the Cloud NAT gateway, specifying each parameter that you want to customize.

    The following examples show how to customize the source subnets, NAT IP address allocation type, network tier, and the port allocation type.

    The command that you run in each of these examples depends on the IP version of the source subnet ranges for which you are configuring NAT.

    • Restrict which source subnets can use NAT. To create a Cloud NAT gateway that restricts which subnets and subnet ranges can use NAT, run one of the following commands:

      • Restrict which IPv4 subnet ranges can use NAT:

        gcloud compute routers nats create NAT_CONFIG \
    --router=NAT_ROUTER \
    --region=REGION \
    --nat-custom-subnet-ip-ranges=IPV4_SUBNET_RANGES \
    --auto-allocate-nat-external-ips

      • Restrict which IPv6 subnet ranges can use NAT:

        gcloud compute routers nats create NAT_CONFIG \
    --router=NAT_ROUTER \
    --region=REGION \
    --nat64-custom-v6-subnet-ip-ranges=IPV6_SUBNET_RANGES \
    --auto-allocate-nat-external-ips

      • Restrict both IPv4 and IPv6 subnet ranges:

        gcloud compute routers nats create NAT_CONFIG \
    --router=NAT_ROUTER \
    --region=REGION \
    --nat-custom-subnet-ip-ranges=IPV4_SUBNET_RANGES \
    --nat64-custom-v6-subnet-ip-ranges=IPV6_SUBNET_RANGES \
    --auto-allocate-nat-external-ips

      Replace the following:

      • NAT_CONFIG: a name for your NAT configuration
      • NAT_ROUTER: the name of the Cloud Router that you created in the previous step
      • REGION: the region where you want to use the Cloud NAT gateway
      • IPV4_SUBNET_RANGES: a comma-separated list of subnet names—for example:
        • SUBNET_NAME_1:ALL,SUBNET_NAME_2:ALL: includes both the primary and all secondary ranges of subnets SUBNET_NAME_1 and SUBNET_NAME_2.
        • SUBNET_NAME_1,SUBNET_NAME_2: includes only the primary ranges of subnets SUBNET_NAME_1 and SUBNET_NAME_2.
        • SUBNET_NAME:SECONDARY_RANGE_NAME: includes the specified secondary range of subnet SUBNET_NAME and doesn't include the primary range
        • SUBNET_NAME_1,SUBNET_NAME_2:SECONDARY_RANGE_NAME: includes the primary range of subnet SUBNET_NAME_1 and the specified secondary range of subnet SUBNET_NAME_2
      • IPV6_SUBNET_RANGES: a comma-separated list of subnet names—for example, SUBNET_NAME_1,SUBNET_NAME_2

    • Configure manual NAT IP address allocation. To create a Cloud NAT gateway with manual NAT IP address allocation, run one of the following commands:

      • For IPv4 subnet ranges:

        gcloud compute routers nats create